Whitelist a specific file in EDR module

[Rob_Musquetier]

The recently installed EDR module is causing alerts constantly on a BitDefender agent .exe file which is causing a lot of noise for the analists. How would I whitelist a specific file found on my endpoints?

[Anonymous]

Hi Rob, spoke on Wednesday to your guys. Should be all set up now.

[BaptOnfroy]

Hi Rob,

You have to edit App Rules in your decoder.
For example, you can add filename.src != ’BitDefender.exe’ 

Regards,